Build Artifacts

Build Artifacts as Supply Chain Evidence

A build artifact should tell a story: source, dependencies, tests, signatures, provenance, and the exact path from commit to deployment.